Store HTTPS state on Blob objects

[annevk]

See whatwg/html#929 for details.

[mikewest]

Note that this will solve at least one source of CSP bypasses (request data from the web, put it into a blob, then window.open the blob). It's something I'm interested in doing for Chrome, I just haven't taken time yet.

[annevk]

Perhaps #142 is a better solution here as you could always retrieve the bytes from a Blob object and put them in another Blob object to circumvent this strategy.

[annevk]

We achieved an even better solution, removal of HTTPS state: whatwg/fetch#1067.